Engineering
Firmware, silicon and process work for embedded engineers.
3 modules · 11 lessons · 104 min
Foundations
Everything every role must know: what the CRA is, who it binds, and when.
What the CRA is and why it exists
The first horizontal cybersecurity law for products with digital elements, and the market failure it targets.
Scope: products with digital elements and the risk classes
What counts as a product with digital elements, what is carved out, and how important/critical classification changes your workload.
Key dates and the transition timeline
What is already binding, what lands in September 2026, and what December 2027 means for products in development today.
Roles: manufacturer, importer, distributor, open-source steward
Who carries which duty in the supply chain, and how a role can change under your feet.
Secure by Design
Annex I Part I turned into concrete firmware engineering practice.
Annex I Part I — the essential security requirements
A requirement-by-requirement walkthrough of what your product must actually do.
Secure boot, root of trust and key management
Building the integrity chain on constrained hardware, and keeping the signing keys alive for a decade.
Secure update mechanisms and rollback protection
Designing an update path you can still rely on nine years from now.
SBOM: generation, formats and lifecycle
Making a machine-readable inventory of your firmware that stays true across releases.
Vulnerability Handling
Annex I Part II: the process obligations that run for the whole support period.
Annex I Part II — the vulnerability handling process
The eight process obligations that run for the whole support period.
Threat modelling and cybersecurity risk assessment
The document every other CRA obligation is justified against.
Testing, fuzzing and evidence you can show an auditor
Building a test programme that satisfies Annex I Part II (3) and produces documentation as a by-product.